The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md file provides installation commands that download and execute remote scripts from https://cua.ai/driver/install.sh and https://cua.ai/driver/install.ps1 using bash -c and iex. Piped execution of remote content is a high-risk pattern that bypasses security reviews and could lead to system compromise if the remote domain or script is hijacked.
[COMMAND_EXECUTION]: The skill relies extensively on executing the cua-driver CLI tool with complex, JSON-formatted arguments to perform GUI automation. This capability allows for significant system interaction, including process launching and input simulation, which could be misused if the agent is manipulated into executing unintended commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources such as application accessibility trees and browser page content. This data is then used to inform the agent's actions, creating a vulnerability surface where malicious content within a third-party application or website could influence or override the agent's instructions.
Ingestion points: GUI snapshots and accessibility trees are fetched via get_window_state (SKILL.md) and browser state via get_browser_state (BROWSER.md).
Boundary markers: While BROWSER.md mentions that page content should be treated as untrusted, the skill instructions lack formal structural delimiters or explicit "ignore" directives to prevent the agent from being influenced by embedded data.
Capability inventory: The skill possesses high-privilege capabilities including window management (set_window_frame), input simulation (click, type_text, press_key), browser control (browser_navigate, browser_download, browser_set_input_files), and clipboard access (clipboard_write).
Sanitization: No evidence of content sanitization or instruction-stripping was found for the data extracted from GUI elements before it is processed by the agent.

cua-driver